SCIENTIFIC 

REPORTS 




OPEN 



SUBJECT AREAS: 

QUANTUM 
INFORMATION 

QUBITS 

INFORMATION THEORY AND 
COMPUTATION 

QUANTUM OPTICS 



Received 
23 April 2013 

Accepted 
29 July 2013 

Published 
16 August 2013 



Correspondence and 
requests for materials 
should be addressed to 
X.F.M. (xma@ 
tslnghua.edu.cn) 



Decoy-state quantum key distribution 
with biased basis choice 

Zhengchao Wei''^, Weilong Wang''^, Zhen Zhang', Ming Gao^, Zhi Ma^ & Xiongfeng Ma' 

'Center for Quantum Information, Institute for Interdisciplinary Information Sciences, Tsinghua University, Beijing, P. R. China, '^State 
Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou, hienan, China. 

We propose a quantum key distribution scheme that combines a biased basis choice with the decoy-state 
method. In this scheme, Alice sends all signal states in the Z basis and decoy states in the X and Z basis with 
certain probabilities, and Bob measures received pulses with optimal basis choice. This scheme simplifies 
the system and reduces the random number consumption. From the simulation result taking into account of 
statistical fluctuations, we find that in a typical experimental setup, the proposed scheme can increase the 
key rate by at least 45% comparing to the standard decoy-state scheme. In the postprocessing, we also apply a 
rigorous method to upper bound the phase error rate of the single-photon components of signal states. 



Quantum key distribution (QKD)''^ is one of the most realistic applications in quantum information. It 
aims at extending a secret key between two distant parties, commonly noted as Alice and Bob. The 
unconditional security has been proven even when an eavesdropper, Eve, has unlimited computation 
power permitted by quantum mechanics'' 

The best known protocol of QKD is the BB84 protocol' presented by Bennett and Brassard in 1984. In BB84, 
Alice encodes the key information randomly into the X and Z bases and sends quantum pulses to Bob. Bob 
measures the received pulses in two bases randomly. After that, they compare the basis through an authenti- 
cated classical channel. The key can only be extracted from the pulses where they use the same basis and this 
results in that on average half of the raw data is discarded. That is, the basis-sift factor is 1/2 in the original 
BB84 protocol. This factor can be improved by the efficient BB84 scheme proposed by Lo et al.^. In the efficient 
scheme, Alice and Bob put a bias in the probabilities of choosing the Z basis and X basis, which can make the 
basis sift-factor close to 100% in the infinitely long key limit. The efficient BB84 scheme is experimentally 
demonstrated in 2009". 

In practical QKD systems, a highly attenuated laser or a weak coherent state source is widely used to substitute 
for a perfect single-photon source which is beyond state-of-the-art technology. A weak coherent state source 
contains multi-photon components (details shown in Methods). When multi-photon states are used for QKD, 
Eve can launch attacks, like the photon- number-splitting (PNS) attack'-" '", to break the security. Since Eve could 
have a full control of the quantum channel, she can make the transmittance of multi-photon states to be 100% in 
the PNS attack. In a conventional security analysis", Alice and Bob have to assume all the losses and errors come 
from the single-photon components in the worst scenario case. As a result, the performance of QKD is very poor. 
To improve the performance of the weak coherent state QKD, Hwang proposed the decoy-state method'^. Instead 
of sending one coherent state, Alice sends pulses with different intensities, so that she can obtain more informa- 
tion to monitor the quantum channel. To maintain the detection statistics of coherent states with different 
intensities. Eve is not able to change the transmittances of single-photon and multi-photon state freely without 
being noticed by Alice and Bob. The security of the decoy-state method is proven'-\ along with various practical 
schemes'''''^ Follow-up experimental demonstrations show that the decoy-state method is a very effective way to 
improve QKD performance"""^". 

Naturally, we can improve the decoy-state method by applying the biased-basis idea of the efficient BB84 
protocol. There are a few observations. First, Alice does not need to choose basis when she chooses the vacuum 
decoy state. Second, if Alice and Bob mainly choose one basis, say Z basis, for key generation, they effectively treat 
X basis as for quantum channel testing. In this sense, the functionality of X basis is similar to the decoy states. 
Intuitively, one may expect to combine decoy states and X basis together. 

Here, we propose a new decoy-state method with biased basis choice, following the widely used decoy-state 
scheme, vacuum + weak decoy-state method'"' (a quick review is shown in Methods), where Alice sends out 
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pulses with three different intensities, vacuum (with an intensity of 
0), weak decoy (with an intensity of v) and signal (with an intensity of 
fi) states. 

1 . Alice prepares all the signal pulses (/i) in the Z basis, where the 
final secure key is extracted from. 

2. She prepares weak decoy pulses (v) in the X and Z with certain 
probabilities. 

3. If she chooses the vacuum decoy state, she does not need to set 
any basis. 

4. Bob measures the received pulses in the X basis and Z basis with 
probabilities and p^, respectively. 

The scheme is summarized in Table 1. In the new scheme, only 4 
sets of preparations are used by Alice. Compared to the original 
vacuum + weak decoy-state method, where 6 sets are used, the 
proposed scheme can simplify the system and reduce the cost of 
random numbers. Later in the simulation, we will show that this 
scheme can also improve the QKD performance. 

Following the GLLP security analysis", the key generation rate"'^' 
is given by 

R>q{-Iec + (Ti[l-H{e,^')]+Qo}, 



Iec=fQt.H{Ef, 
Ntotal ' 



(1) 



where q is the raw data sift factor, including basis-sift factor and 
signal-state ratio; 7^^ is the cost of error correction and the rest terms 
in the bracket is the rate of privacy amplification; / is the error 
correction inefficiency; Q^, and are the overall gain and quantum 
bit error rate (QBER); Qjis the gain of the single-photon components 
and ef^is its corresponding phase error rate; Qq is the background 
gain; H{x) = —x log2(x) — (1 — x) log2(l — x) is the binary Shannon 
entropy function. Note that in our scheme, the final key is extracted 
from Z-basis measurement results, so all the variables in equation ( 1 ) 
should be measured in the Z basis. The phase error rate e/'^cannot be 
measured directly, which, instead, can be inferred from the error rate 
in the X basis^^. 

The gain and QBER, and can be measured from the experi- 
ment directly. Alice and Bob need to estimate and ef ^for privacy 
amplification. According to the model reviewed in Methods, we have 
Qj = Y^j.ie^ ''and Qg = Foe ''> where yf and Yg are the yield of single- 
photon components measured in the Z basis and background rate, 
respectively. In order to lower bound the key rate equation (1), 
one can lower bound , Yq and upper bound ef^. 

Since that both the vacuum state and the single-photon state are 
basis independent, the yields of vacuum states and single-photon 
states in different bases are equal 



yx _ yZ 



(2) 



While a multi-photon state is basis dependent, whose basis informa- 
tion maybe revealed to Eve by, for example, PNS attack', so for any i- 
photon state (; s 2), in general, 

Yf^Yf. (3) 

That is, depending on the basis information. Eve may set the yield of 
i-photon state different for the X and Z bases. As for the error rates, 
the phase error probability in the Z basis equals to the bit error 
probability in the X basis 



Then, in the finite-key-size situation where statistical fluctuations 
should be taken into account^^'^\ we have 



Table 1 List of Alice and Bob's operations. Alice prepares and 
sends Nfatai pulses, with Ntotai = N,, + N^. + N^. + No . Bob measures 
the received pulses with certain probabilities, Pz + Px= 1 


Alice prepares and sends 


Bob measures 


N,, signal pulses in the Z basis 
decoy pulses in the Z basis 
decoy pulses in the X basis 

No vacuum pulses 


with probability in the Z basis 
with probability in the X basis 



(5) 



Given gj^, we can upper bound ef^ by the random sampling argu- 
ment (details shown in Methods). We need to point out that even 
though the single-photon state is basis independent, the error rates in 
two basis may not be the same 

el^ei. (6) 

This can be easily seen by considering a simple intercept-and-resend 
attack where Eve measures all the pulses in the Z basis, and then she 
will not introduce any additional error in the Z basis Cj = 0, but 
4 = 1/2. 

Results 

In our simulation, the parameters of the experimental setup are listed 
in Table 2. Statistical fluctuations are taken into account in the simu- 
lation (details shown in Methods). We compare the key generation 
rate in our scheme with that in the standard BB84 protocol with the 
vacuum -I- weak decoy-state scheme. The result is shown in Fig. 1. 

As one can see from Fig. 1, the key rate of the proposed biased 
scheme is larger than that of the standard BB84 with vacuum + weak 
decoy states by at least 45%. When the transmission loss is 0, the key 
rate improvement can go up to 80%. As the transmission loss 
increases, the improvement of the biased scheme decreases. This is 
because at a larger transmission loss, more pulses for decoy states are 
needed and Bob also needs a larger p^ to estimate the privacy amp- 
lification part in Eq. (1). The improvement comes from the fact that 
px is less than 1/2. As p^ approaches to 1/2, the biased scheme 
becomes similar to the original scheme, where px — pz ~ 1/2. It is 
an interesting prospective question how to apply our scheme to QKD 
systems with high channel losses^"*. 

For a practical QKD system, one needs to optimize the bias p^ for 
the key rate. The dependence of the optimal bias on the transmission 
loss is shown in Fig. 2, from which we can see that the optimal p^ is 
about 0.95 when the transmission loss is below 3 dB and decreases as 
the transmission loss increases. The minimal optimal pj, is about 0.6, 
which is close to 1/2. That is why our scheme approaches the stand- 
ard BB84 with the vacuum + weak decoy-state scheme as the trans- 
mission loss increases. 

Discussion 

In conclusion, we combine the decoy-state QKD with a biased basis 
choice to enhance the system performance. The key point of our 
scheme is increasing the raw data sift factor by setting all signal states 
in one (Z) basis. We take statistical fluctuations into account and use a 
rigorous method to upper bound the phase error rate of the single- 
photon components of the signal state. Comparing the result with that 
in the standard decoy-state BB84 protocol, we find an improvement in 



Table 2 | List of experimental parameters for simulation 

6x 10' 1.16 3.3% 1.7 X 10^ 
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Figure 1 | Plot ofkey rate versus total transmittance. The solid line shows 
the result of our scheme and the red line shows the result of the standard 
BB84 with the vacuum + weak decoy-state method. The simulation 
parameters are shown in Table 2. The confidence interval for statistical 
fluctuation is 5 standard deviations (i.e., 1-5.73 X 10"^). The expected 
photon number of signal state /.i is 0.479. For each transmission loss, we 
optimize all the parameters, v, JV^, N^, NJ^, Nq, p^, and p^. 

the key generation rate. Meanwhile, we reduce the complexity of the 
QKD system by assigning all signal states in the Z basis. 

Methods 

Model. The weak coherent state source is equivalent to a photon-number channel 
model and its photon number follows a Poisson distribution^^: 



P(n) 



(7) 



Define Y, as the yield of an /-photon state; ;^ as the transmittance of the channel 
measured in dB\ Yq as the background count rate. Then, in a normal channel when 
there is no Eve's intervention, 7,- is given by: 

7, = I-(l-7o)(l-;,)'. (8) 



The gain of f-photon states Q, is given by: 



Q, = YAe->'. 



(9) 



The overall gain which means the probability for Bob to obtain a detection event in 
one pulse with intensity t-i is: 




5 10 15 20 25 

Total transmission loss (dB) 
Figure 2 | Plot of optimal versus transmission loss. 
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i=0 j=0 

The error rate of i-photon states is given by 

eiYi = eaY„ + ea[l-{l-ny]{l-Ya), 



(10) 



(11) 



where is the probability that a photon hits the erroneous detector and — 1/2. The 
overall QBER is given by 



Without Eve changing Y, and e,, the gain and QBER are given by 

Q„ = l-e-'"'(l-7o), 
E„Q„ = eoYo + eu{l-e-'"){l-Yo) 



(12) 



(13) 



Upper bound of . Here, we review the random sampling argument^^: using the bit 
error rate measured in the X basis, e\^, to estimate the phase error rate in the Z basis, 
ef^, for privacy amplification. 

If the key size is infmite, we know that e^^ — ef^. Otherwise, given e'/'', (the 
number of decoy states that Alice sends and Bob measures in the X basis), and {the 
number of signal states that Alice sends and Bob measures in the Zbasis), we can give 
a probabilistic upper bound of ef^ such that it is lower than ef^ with a small prob- 
ability Pfe 



Pox^Pr{ep,>eb^ + e^}, 



(14) 



where 6^ is the deviation of the phase error rate from the tested value. Here, Pq^^ is a 
controllable variable and is equal to 10"^ in the simulation. We have 



7-(«x + «.)C,(».) 



where the function iixif^x) is given by 

Ue.)=H{et, + e,-qA)-q,H{ei„)-{l-q,)H{e 



(15) 



(16) 



and qx — nJin^ + n^}. Given P^, we compute the value of and fmd the value ( 
which is the root of equation (16). We get the probabilistic upper bound 



(17) 



Vacuum + weak decoy state. In this protocol, Alice and Bob use two decoy states to 
estimate the low bound of Yi and the upper bound of e^. First, they implement a 
vacuum decoy state to estimate the background counts in signal states 



^vacuum — ^0 

E, 



(18) 



vacuum — ^0 — ^ ' 



Secondly, they perform a weak decoy state where Alice uses a weaker intensity v (v < 
jj.) for the decoy state to estimate Yi and ei. We have: 



Yi > Yi = Qy - Q.e" ^ 

/IV — \ /c^ 



and 



E,Q,e'--e„Yo 
7fv 



(19) 



(20) 



Note that in our scheme all the parameters for estimating Y^^are measured in the Z 
basis and the parameters for estimating e^are measured in the X basis. And we must 
lower bound Yq to obtain the lower bound of the key rate^^. The e^we get here will 
substitute e^x in equation (14). 

Statistical fluctuation. Here, we consider statistical fluctuations for the decoy-sate 
method^^. We need to modify the estimation of Yi, equation (19), and Ci, equation 
(20). 

The total number of pulses sent by Alice is composed of four cases 

Ntotai-Nf,-\-N^,-\-N^,-i-No. (21) 

Since that Alice sends all signal states in the Z basis and the fmal key is only extracted 
from the data measured in the Z basis, the parameter q in equation (1) is given by 



We follow the statistical fluctuation analysis proposed by Ma et al} 



(22) 
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(23) 



= 3^0 1 



QS = 7^e-" 1 



where Q^, Q,,and Yo^re measurement outcomes which means that they are rates 
instead of probabilities. If we follow the standard error analysis assumption, is the 
number of standard deviations one chooses for the statistical fluctuation analysis. 
Note that Q|;'and Q^are used to estimate Y^, so they should be measured in the Z 
basis. Here we use equation (14) to estimate the upper bound of ef^with 



(24) 
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